North Carolina Security Breach Reporting Form 
Pursuant to the Identity Theft Protection Act of 2005 

*lndicated a mandatory field 

*Name of the Company or Government Agency owning or licensing information affected by the entity experiencing 
breach: 

MCGL1NCHEY STAFFORD, PLLC 


Entity Type: 
Address: 

Apt/ Suite/Building: 
City: 

State: 

Zip Code: 
Telephone: 

Fax: 

Email: 


GENERAF BUSINESS 
301 MAIN STREET 
SUITE 1400 
BATON ROUGE 
LA 
70801 


*Date Security breach Reporting Form Submitted: 10/08/2018 

Is this notice a supplement to a previously filed NO 

Security Breach: 

*Date the Security Breach was discovered: 09/07/2018 

Breach Type: PHISHING 

*Estimated number of affected individuals: 468 

*Estimated number of NC residents affected: 2 


Name of company or government agency maintaining or possessing information that was the subject of 
the Security Breach, if the agency that experienced the Security Breach is not the same entity as the 
agency reporting the Security Breach (pursuant to N.C.G.S. 75-65(b)) 


Describe the 
circumstances 
surrounding the 
Security Breach: 


ON SEPTEMBER 7, 2018,MCGLINCHEY STAFFORD, PLLC DISCOVERED 
THAT INDIVIDUALS’ PERSONAL INFORMATION MAY HAVE BEEN 
OBTAINED BY AN UNAUTHORIZED THIRD PARTY AS THE RESULT OF A 
PHISHING ATTACK. AFTER LEARNING THAT SPAM EMAILS WERE SENT 
FROM AN EMPLOYEE’S EMAIL ACCOUNT TO OTHER EMPLOYEES IN THE 
FIRM, MCGLINCHEY STAFFORD, PLLC IMMEDIATELY ENGAGED 
COMPUTER EXPERTS TO DETERMINE WHETHER INFORMATION IN THE 
ACCOUNT WAS AT RISK. THE INVESTIGATION DETERMINED THAT AN 
UNKNOWN, UNAUTHORIZED THIRD PARTY GAINED ACCESS TO THE 
EMPLOYEE’S ACCOUNT, AND COULD HAVE VIEWED DOCUMENTS THAT 
CONTAINED INDIVIDUALS’ NAMES AND SOCIAL SECURITY NUMBERS. 


Information Type: SSN 


*Regarding YES 

information 

breached, if 



electronic, was the 
information 
protected in some 
manner: 

If YES, please PASSWORD PROTECTED EMAIL ACCOUNT 

describe the 

security measures 

protecting the 

information: 


^Describe any MCGLINCHEY STAFFORD, PLLC HAS TAKEN STEPS TO PREVENT A 
measures taken to SIMILAR EVENT FROM OCCURRING IN THE FUTURE, INCLUDING 

prevent a similar REVIEWING AND REVISING THEIR INFORMATION SECURITY POLICIES 
Security Breach AND RESETTING EMPLOYEE’S ACCESS CREDENTIALS TO ENSURE 
from occurring in THEIR SYSTEMS ARE SECURE, 
the future: 

*Date affected NC 10/08/2018 
residents were/will 
be notified: 


Describe the circumstances surrounding the delay in notifying 
affected NC residents pursuant to N.C.G.S. 75-65 (a) and (c): 

If the delay was pursuant to a request from law enforcement pursuant to N.C.G.S. 75-65(c), please 
attach or mail the written request or the contemporaneous memorandum. 

How NC residents WRITTEN NOTICE 

were/will be 

notified? (pursuant 

to N.C.G.S. 75-65 

(e)): 

Please note if the business demonstrates that the cost of providing notice would 
exceed two hundred fifty thousand dollars ($250,000) or that the affected class of 
subject persons to be notified exceeds 500,000, or if the business does not have 
sufficient contact information or consent to satisfy subdivisions (1), (2), or (3) of 
this subsection, for only those affected persons without sufficient contact 
information or consent, or if the business is unable to identify particular affected 
persons, for only those unidentifiable affected persons. Substitute notice shall 
consist of all the following: 

• Email notice when the business has an electronic mail address for the 
subject persons 

• Conspicuous posting of the notice on the Web site page of the business, if 
one is maintained 

• Notification to major statewide media 



Please attach a copy of the notice if in written form or a copy of any scripted notice if in telephonic 
form. 


Contact Information ATTORNEY 

Affiliation with entity 
experiencing breach: 

Organization Name: WILSON ELSER MOSKOWITZ EDELMAN & DICKER LLP 

Prefix: 

*FirstName: GREGORY 


Middle Name: 
*Last Name: 
Suffix: 

Title: 

Address: 

Apt/Suite/building: 

City: 

State: 

*Telephone: 

Email: 


BAUTISTA 


1133 WESTCHESTER AVENUE 
WHITE PLAINS 

NY Zip Code: 10604 

(914) 872-7839 Fax: 

GREGORY.BAUTISTA@WILSONELSER.COM 



^ Msglinchey Stafford 


C/0 ID Experts 

10300 SW Greenburg Rd. Suite 570 
Portland, OR 97223 


[First Name] [Last Name] 
[Address 1] [Address 2] 
«City», «State» «Zip» 


To Enroll, Please Call: 
800-939-4170 
Or Visit: 

https://app.myidcare.com/account- 

creation/protect 

Enrollment Code: 

«xxxxxxxx» 


10/8/2018 


Dear [First Name] [Last Name]: 

We are writing to inform you of an incident that may have resulted in the disclosure of your name and Social Security 
number. As a current or former employee of McGlinchey Stafford PLLC, we take the security of your information very 
seriously and sincerely apologize for any inconvenience this incident may cause. 

On September 7, 2018, we discovered that personal information in an employee’s email account may have been accessed 
by an unauthorized third party as the result of a phishing attack. After learning that employees of the firm had received 
spam emails, we immediately engaged computer experts to determine whether information in the employee’s account was 
at risk. Our investigation determined that an unknown, unauthorized third party gained access to the employee’s account, 
and could have viewed documents that contained your name and Social Security number. The investigation did not identify 
specific activity around your information, but we are sending you this letter to provide you with resources and information 
you can use to protect yourself. 

At this time, there is no indication that your information has been accessed or used by the unauthorized party; however, out 
of an abundance of caution, we have arranged for you to enroll with ID Experts®, an incident response and recovery services 
expert, to provide you with MyIDCare™ services at no cost to you. MyIDCare services include: 

• 12 months Credit Monitoring and Cyber Sc an monitoring; 

• $ 1,000,000 insurance reimbursement policy; 

• Exclusive educational materials; and 

• Fully managed Identity Theft Recovery Services (with this protection, MyIDCare will help you resolve issues if 
your identity is compromised). 

We encourage you to contact ID Experts with any questions and to enroll in free MyIDCare services by calling 1 -800-939- 
4170 or going to https://app.myidcare.com/account-creation/protect . Please note the deadline to enroll is January 8, 2019. 
Please review the Additional Important Information on the third and fourth pages of this letter to learn about the additional 
steps you can take to protect your information at no cost (for example, by asking a consumer reporting agency to place a 
fraud alert or security freeze on your consumer report information). 

We want to assure you that we remain dedicated to protecting your personal information, and are continuing to take steps 
to prevent a similar event from occurring in the future, including reviewing and revising our policies and resetting 
employees’ access credentials to ensure our systems are secure. 






We sincerely regret any inconvenience that this incident may cause you, and remain dedicated to protecting your personal 
information. Should you have any questions or concerns about this incident, please contact 800-939-4170 Monday through 
Friday from 6 am - 5 pm Pacific Time or visit https://app.myidcare.com/account-creation/protect for more information. 


Sincerely, 



Thad Hymel 

Chief Information Officer 
McGlinchey Stafford, PLLC 



Additional Important Information 


For residents of Hawaii , Michigan , Missouri , Virginia, Vermont and North Carolina: It is recommended by state law 
that you remain vigilant for incidents of fraud and identity theft by reviewing credit card account statements and 
monitoring your credit report for unauthorized activity. 


For residents of Illinois , Iowa, Maryland , Missouri , North Carolina, Oregon, and West Virginia: 

It is required by state laws to inform you that you may obtain a copy of your credit report, free of charge, whether 
or not you suspect any unauthorized activity on your account. You may obtain a free copy of your credit report 
from each of the three nationwide credit reporting agencies. To order your free credit report, please visit 
www.annualcreditreport.com , or call toll-free at 1-877-322-8228. You can also order your annual free credit report by 
mailing a completed Annual Credit Report Request Form (available at https://www.consumer.ftc.gov/articles/0155-free- 
credit-reports) to: Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA, 30348-5281. _ 

For residents of Iowa: 

State law advises you to report any suspected identity theft to law enforcement or to the Attorney General. _ 

For residents of Ore son: 

State laws advise you to report any suspected identity theft to law enforcement, including the Attorney General, and 
the Federal Trade Commission. _ 

For residents of Maryland, Rhode Island , Illinois , and North Carolina: 

You can obtain information from the Maryland and North Carolina Offices of the Attorneys General and the 
Federal Trade Commission about fraud alerts, security freezes, and steps you can take toward preventing identity 
theft. 


Maryland Office of the 
Attorney General 

Consumer Protection 
Division 

200 St. Paul Place 
Baltimore, MD 21202 
1-888-743-0023 
www.oag.state.md.us 


Rhode Island Office of the 
Attorney General 

Consumer Protection 
150 South Main Street 
Providence RI02903 
1-401-274-4400 
www.riag.ri.gov 


North Carolina Office of the 
Attorney General 

Consumer Protection 
Division 

9001 Mail Service Center 
Raleigh, NC 27699-9001 
1-877-566-7226 
www.ncdoj.com 


Federal Trade Commission 

Consumer Response Center 
600 Pennsylvania Ave, NW 
Washington, DC 20580 
1-877-IDTHEFT (438-4338) 
www.ftc.gov/idtheft 


For residents of Massachusetts: It is required by state law that you are informed of your right to obtain a police report if you 
are a victim of identity theft 

For residents of all states: 


Fraud Alerts: You can place fraud alerts with the three credit bureaus by phone and 
online with Equifax ( https://assets.equifax.com/assets/personal/Fraud Alert Request Form.pdf ) or Experian 
(https://www.experian.com/fraud/center.htmr ). A fraud alert tells creditors to follow certain procedures, including 
contacting you, before they open any new accounts or change your existing accounts. For that reason, placing a fraud alert 
can protect you, but also may delay you when you seek to obtain credit. As of September 21, 2018, initial fraud alerts last 
for one year. Victims of identity theft can also get an extended fraud alert for seven years. The phone numbers for all three 
credit bureaus are at the bottom of this page. 

Monitoring: You should always remain vigilant and monitor your accounts for suspicious or unusual activity. 




Security Freeze: You also have the right to place a security freeze on your credit report. A security freeze is 
intended to prevent credit, loans and services from being approved in your name without your consent. To place a 
security freeze on your credit report, you need to make a request to each consumer reporting agency. You may 
make that request by certified mail, overnight mail, or regular stamped mail, or by following the instructions 
found at the websites listed below. The following information must be included when requesting a security freeze 
(note that if you are requesting a credit report for your spouse or a minor under the age of 16, this information 
must be provided for him/her as well): (1) full name, with middle initial and any suffixes; (2) Social Security 
number; (3) date of birth; (4) current address and any previous addresses for the past five years; and (5) any 
applicable incident report or complaint with a law enforcement agency or the Registry of Motor Vehicles. The 
request must also include a copy of a government-issued identification card and a copy of a recent utility bill or 
bank or insurance statement. It is essential that each copy be legible, display your name and current mailing 
address, and the date of issue. As of September 21, 2018, it is free to place, lift, or remove a freeze. You may 
obtain a free security freeze by contacting any one or more of the three national consumer reporting agencies: 

TransUnion (FVAD) 

P.O. Box 2000 
Chester, PA 19022 
freeze.transunion.com 
800-680-7289 

More information can also be obtained by contacting the Federal Trade Commission listed above. 


Equifax Security Freeze 

P.O. Box 105788 
Atlanta, GA 30348 
www.freeze.equifax.com 
800-525-6285 


Expenan Security Freeze 

P.O. Box 9554 
Allen, TX 75013 
www.experian.com/freeze 
888-397-3742 



